Abstract: A method is described for detecting rogue packets in real-time protocol (“RTP”) data streams. Rogue packets occur due to a malfunctioning device continuing to send RTP packets after the termination of the media session, or by third party devices due to malfunction or malicious activity. The method recognizes rogue RTP packets by examining identifying fields in each packet associated with the RTP stream. The fields can be in the header of the packet or in the payload, and can include information such as destination address, destination port, protocol, sequence number, SSRC number, and others. Once rogue activity is detected the method can quarantine the associated pinhole information and/or alert a network operator.

Abstract: A method is described for detecting rogue packets in real-time protocol (“RTP”) data streams. Rogue packets occur due to a malfunctioning device continuing to send RTP packets after the termination of the media session, or by third party devices due to malfunction or malicious activity. The method recognizes rogue RTP packets by examining identifying fields in each packet associated with the RTP stream. The fields can be in the header of the packet or in the payload, and can include information such as destination address, destination port, protocol, sequence number, SSRC number, and others. Once rogue activity is detected the method can quarantine the associated pinhole information and/or alert a network operator.

Abstract: A method is described for matching complex patterns in internet protocol (IP) data streams. The method associates each data packet with a specific flow in the IP data stream. The packet is broken into fixed length contexts and state information for that flow is retrieved. The method then determines using a data base of known signatures and the state information whether there is a potential match between the incoming data stream and a signature in the database of known signatures. If a potential match is found the method then determines whether there is an exact match between the potential signature and the incoming data stream. The state information is then updated to reflect the outcome of the scanning. When and exact match is found a conclusion is reached that determines the treatment for the incoming data stream. The state information allows the pattern matching engine to match patterns across packet boundaries and to perform complex matches.

Abstract: A pattern matching engine is describe for matching complex pattern in internet protocol (IP) data streams. The pattern matching engine compares the incoming IP data stream to a database of known signatures to determine if there is a match. The pattern matching engine first uses a rake engine to determine if there are any potential matches between a signature in the database and the incoming IP data stream. If a signature is determined to be a potential match, a ruler engine in the pattern matching engine is then used to determine if the signature and the incoming data stream are an exact match. When and exact match is found a conclusion is reached that determines the treatment for the incoming data stream. The pattern matching engine also includes a session memory that is used to maintain state for one or more of the flows contained in the IP data stream. The state stored by the session memory allows the pattern matching engine to match patterns across packet boundaries and to perform complex matches.

Abstract: There is disclosed, for use in an x86-compatible processor, a translation look-aside buffer (TLB) that stores region configuration bits (or attribute bits) associated with each physical address stored in the TLB and that makes the region configuration bits available at the same time that the physical address is generated/translated by the TLB. The TLB comprises: 1) a tag array capable of storing an untranslated address in one of N tag entries in the tag array; 2) a data array capable of storing a translated physical address corresponding to the untranslated address in one of N data entries in the data array; and 3) a region configuration array capable of storing region configuration bits associated with the translated physical address in one of N region configuration entries in the region configuration array.